Binance lost $6.3 billion in 20 minutes. What crypto is, what actually happened, and what to do if you have money on an exchange

First, what crypto is, in plain English

Skip this if you know it. A cryptocurrency like bitcoin is money that exists only as entries in a shared ledger, a list of who owns what that thousands of computers around the world keep identical copies of. Nobody runs it. No bank, no government. You own a coin if you hold a secret code, called a private key, that lets you sign a transfer out of your address. Lose the key, lose the coins. Someone steals the key, they own the coins. There's no customer service line to call and no way to reverse a transfer once it's recorded.

That's hard to live with, so most people don't do it. They open an account at an exchange, which is a company like Binance, Coinbase or Kraken that works like a brokerage. You send them dollars, they buy coins for you, and they hold the keys. What you see in the app is a balance on their books, an IOU, the same way your bank balance is. The exchange keeps most customer coins in "cold" wallets, kept offline, and a small share in "hot" wallets connected to the internet so people can withdraw. Hot wallets are where hacks happen.

One more term. A stablecoin is a crypto token designed to always be worth one dollar. The two big ones are USDT, issued by a company called Tether, and USDC, issued by Circle. Because a company issues them, the company can freeze them. Bitcoin has no company behind it, so nobody can freeze it. That difference decides how much of Thursday's money comes back.

What happened Thursday

Binance is the largest crypto exchange in the world by volume. It isn't available to Americans, who get a separate and much smaller company called Binance.US, but what happens to Binance moves the price of everything. Starting at 20:05 UTC, which is 4:05 p.m. Eastern, somebody with valid signing authority began sending coins out of Binance's hot wallets across ten different blockchains at once: Ethereum, Bitcoin, Tron, the XRP Ledger, Solana and five smaller ones. Blockchain intelligence firm TRM Labs puts the total at about $6.36 billion at the prices when each transfer went through, most of it in roughly 20 minutes, with a second smaller wave around 7 p.m. Eastern. (TRM Labs)

For scale, the previous record was Bybit, another exchange, which lost $1.5 billion in February 2025. This is four of those. Binance's own number, from its statement early Friday, is "around $6.3B." It suspended all deposits and withdrawals, revoked the stolen permissions and said it "will cover all losses from the SAFU fund and the company's funds. User funds are safe." SAFU is an emergency reserve Binance set up in 2018 for exactly this. Binance hasn't said how big it is today, and it hasn't given a date for withdrawals to reopen. Co-founder Yi He reportedly said Sunday. (Binance's statement, Crypto Briefing)

Here's what left, by TRM's count:

• About $3.8 billion from Ethereum. Roughly 200,000 ETH plus 185 other tokens, including $1.875 billion of USDT and $823 million of USDC.
• 18,270 bitcoin, about $1.4 billion. Sent in 11 transactions to one address, then split into 19 wallets, 17 of them holding exactly 1,000 BTC. As of early Friday none of it had moved. (CoinDesk)
• About $628 million from Tron, mostly USDT, $296 million in XRP, $96 million in Solana, and under $80 million across Arbitrum, Optimism, Base, Avalanche and Polygon.

How a $6 billion theft starts with one laptop

Binance's initial finding is that the attacker got into "a compromised DevOps engineer's laptop," which gave access to a service container, which is one of the internal systems that submits withdrawal transactions. Binance says it found "no evidence of any wallet private key leak." Read that carefully. The keys didn't leak. The attacker didn't need them. They got into the system that is allowed to use the keys, and asked it to sign.

On Ethereum the method was a single transaction carrying 50 pre-signed permission slips, a newer feature called EIP-7702 that lets an address delegate control. One of the 50 handed over a major Binance hot wallet. The signatures appear to have been collected in advance and fired all at once, which is the same pattern as Bybit. On the other nine chains the transfers were ordinary, correctly signed withdrawals. From the blockchain's point of view, Binance sent the money. (TRM Labs)

I build apps for a living, and this is the part that will stay with me. A company with billions in reserves, its own security team and years of being the biggest target in the industry was not beaten by someone cracking its vault. It was beaten by someone getting onto one employee's computer. That's the lesson for everyone, not just exchanges. Your phone and your laptop are the keys to everything behind them.

Who did it

TRM Labs says, "with high confidence," that it was TraderTraitor, the North Korean state hacking unit the FBI named for the Bybit theft, based on the same staging pattern, the same way of funding the setup wallets through Tornado Cash, and other intelligence it didn't publish. Other investigators, including the researcher ZachXBT and the security firm Blockaid, point the same way. Binance itself has not named anyone. Its statement says it is working with law enforcement "to confirm the identity of these criminals." Until Binance or a government says it, treat North Korea as the strong working theory, not the verdict. (TRM Labs, Al Jazeera)

If it holds, this is the same group that has funded a nuclear weapons program with crypto theft for a decade, and Thursday would be its biggest payday by a wide margin.

Why some of it is already frozen, and some never will be

Remember the stablecoin point. Within an hour, Tether froze about $971 million of USDT sitting in the thief's main wallet, and Circle froze $823 million of USDC. By Friday morning TRM counted about $1.77 billion frozen by Tether, $825 million by Circle, $40 million by Ripple and smaller amounts by others, around $2.7 billion in all. Binance says about $3 billion. Those coins are stuck, and they'll eventually come back to Binance through a court process. (NBC News)

The bitcoin and the ether are different. Nobody can freeze bitcoin. The 18,270 BTC are sitting in 19 wallets that everyone in the world can see and nobody can touch. The thief also holds more than 420,000 ETH, some of it bought at a discount by dumping stolen USDT on market makers before Tether caught up. TRM's estimate is about $2.4 billion that is beyond any issuer's reach. The only way to stop it is at the exits, when the thief tries to turn it into something spendable through an exchange or a swap service. After Bybit, the same group took about ten days to start that process. Expect the same slow chase here. (CoinDesk)

What it did to prices

Bitcoin was already under $80,000 after the Fed held rates on Wednesday. It dropped below $77,000 overnight and was around $78,400 Friday morning, down about 2 percent on the day and 5 percent on the week. Ether and BNB, Binance's own token, fell harder. About $1.5 billion of leveraged bets got liquidated in 24 hours, hitting roughly 239,000 traders. If you're wondering why a hack of one company moves the price of bitcoin itself, it's because a scared market sells first, and because people worry the thief will have to sell $1.4 billion of bitcoin eventually. (crypto.news)

That's a bad day, not a crash. For context, bitcoin has moved more than that on an ordinary Tuesday this year.

If you have money on an exchange, any exchange

• If it's on Binance: wait. You can't withdraw right now anyway, and Binance has said in writing it will cover losses. Panicking into a sale when withdrawals reopen locks in Thursday's price for no reason. Binance's founder, who is still its largest shareholder, posted that he expects "all user funds will be fully covered." It has the history to back that up, and this time it has $3 billion frozen on its side.
• Expect scams this weekend. Every big hack is followed by emails, texts and DMs offering to "secure" or "recover" your account. Binance will not text you a link. Nobody legitimate will ask for your seed phrase, your password or a "verification deposit." Go to the app yourself, never through a link.
• Turn on two-factor authentication with an app, not a text message. On every exchange and on the email account attached to it. This attack didn't go through a customer account, but the copycats this weekend will.
• Know what you're holding. Coins on an exchange are an IOU from a company. There's no FDIC behind it. If you hold more than you'd be comfortable losing to a company's bad week, a hardware wallet costs about the price of a dinner out and moves the keys to you. The trade is that nobody can bail you out of your own mistakes either. That's the deal crypto has always offered, and Thursday is the clearest reminder in a while.
• If you're American and never had a Binance account, this doesn't touch your money directly. Binance.US is a separate company and I haven't seen any statement that it was affected. The price moves are the only thing that reaches you.

What I'm doing

Nothing. I don't own crypto directly, and I don't say that as a boast, it's just where I landed. I own broad index funds, and the companies in them that touch crypto, Coinbase, the payment networks, the chipmakers, will shrug this off by the time the next quarterly report comes out. If I did own coins, I'd want them on a hardware wallet after this week, and I'd want much less of my net worth in them than the people getting liquidated on Thursday night had.

The thing I'll keep thinking about isn't the $6 billion. It's the laptop. One compromised machine, belonging to one person who had the wrong access at the wrong time, cost more than most countries' yearly budgets. Update your phone. Use a password manager. Turn on the two-factor. That advice sounds small next to a number like this, and it's exactly the advice that would have stopped it. I'm not a financial advisor, and this isn't advice for your situation. It's how I'm thinking about mine.

Verified October 30, 2026, early morning Eastern, from Binance's Security Incident Update, TRM Labs' on-chain analysis (figures as of 00:30 UTC Friday), CoinDesk, NBC News, Al Jazeera and crypto.news (liquidation figures from CoinGlass). This story is less than a day old: the frozen total, the attribution and the reopening date will all change, and Binance has promised a full technical post-mortem. The North Korea attribution is TRM's assessment, not Binance's or any government's. I'll update when the facts do.